Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

## Unreleased

- changed: Update sideshift plugin with new optional API fields
- changed: Add signature header support to Exolix
- changed: Add index for orderId
- changed: Add EVM chainId, pluginId, and tokenId fields to StandardTx
Expand Down
21 changes: 18 additions & 3 deletions src/partners/sideshift.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
import {
asArray,
asMaybe,
asNumber,
asObject,
asOptional,
asString,
Expand Down Expand Up @@ -156,14 +157,23 @@ const asSideshiftTx = asObject({
prevDepositAddresses: asMaybe(asObject({ address: asMaybe(asString) })),
depositAsset: asString,
depositNetwork: asOptional(asString),
depositHash: asOptional(asString),
depositContractAddress: asOptional(asString),
// asMaybe so an unexpected encoding (e.g. a numeric string) degrades to
// undefined instead of throwing and aborting the whole 5-day query block
depositEvmChainId: asMaybe(asNumber),
invoiceAmount: asString,
settleAddress: asObject({
address: asString
}),
settleAmount: asString,
settleAsset: asString,
settleNetwork: asOptional(asString),
createdAt: asString
settleHash: asOptional(asString),
settleContractAddress: asOptional(asString),
settleEvmChainId: asMaybe(asNumber),
createdAt: asString,
settledAt: asOptional(asString)
})

const asSideshiftPluginParams = asObject({
Expand Down Expand Up @@ -363,7 +373,12 @@ export async function processSideshiftTx(
status: statusMap[tx.status],
orderId: tx.id,
countryCode: null,
depositTxid: undefined,
// On EVM networks, TRON, Aptos, Sui, NEAR, and Algorand, SideShift's
// depositHash is the internal sweep transaction (deposit contract to
// their wallet), not the customer's own deposit transaction. The API
// exposes no better field, so treat this as an order reference, not a
// pointer to the customer's on-chain payment.
depositTxid: tx.depositHash,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wrong hash in depositTxid

Medium Severity

depositTxid is set from tx.depositHash, which on EVM, TRON, Aptos, Sui, NEAR, and Algorand is SideShift’s internal sweep (deposit contract → their wallet), not the customer’s deposit. Other plugins treat depositTxid as the customer pay-in hash, so consumers tracing the user’s on-chain payment follow the wrong transaction for those networks. Leaving it unset was more accurate than storing a misleading hash.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 3efce41. Configure here.

depositAddress,
depositCurrency: tx.depositAsset,
depositChainPluginId: depositAsset.chainPluginId,
Expand All @@ -373,7 +388,7 @@ export async function processSideshiftTx(
direction: null,
exchangeType: 'swap',
paymentType: null,
payoutTxid: undefined,
payoutTxid: tx.settleHash,
payoutAddress: tx.settleAddress.address,
payoutCurrency: tx.settleAsset,
payoutChainPluginId: payoutAsset.chainPluginId,
Expand Down
2 changes: 2 additions & 0 deletions src/queryEngine.ts
Original file line number Diff line number Diff line change
Expand Up @@ -187,9 +187,11 @@ export async function queryEngine(): Promise<void> {
const checkUpdateTx = (oldTx: StandardTx, newTx: StandardTx): string[] => {
const fields = [
'status',
'depositTxid',
'depositChainPluginId',
'depositEvmChainId',
'depositTokenId',
'payoutTxid',
'payoutChainPluginId',
'payoutEvmChainId',
'payoutTokenId'
Expand Down
Loading